[Indicators] Complete greeter profiles

[Pat McGowan]

A recent change in the interest of security removed access to the indicators when the phone is locked and the greeter is showing.

This was an accentual change based on a misunderstanding

There had been a plan to support media playback control via the sound indicator. Without this the user must unlock the phone in order to simply pause the music or change songs, etc.

----------------------------
Desired resolution:

- Revert the change that caused this issue

- Add a switch to System Settings to enable security conscious user to switch off Launcher and Greeter access while the phone is locked. This setting should *always* be off by default. <https://wiki.ubuntu.com/SecurityAndPrivacySettings#Locking>

[Michał Sawicz (saviq)]

Should enabling the setting actually prevent you from accessing the launcher / indicators? Or is it meant to just reduce the scope of the indicators instead?

[John Lea (johnlea)]

Enabling this setting should just prevent the user from accessing the launcher / indicators .

[Pat McGowan (pat-mcgowan)]

Are there thoughts for a more complete design which would only disable certain interactions, but allowing others?
Such as media control, viewing battery usage, etc but not allowing the user to reply to messages, for example.

[Michał Sawicz (saviq)]

I agree, disabling them altogether is not friendly at all.

[Michael Terry (mterry)]

In London the plan I heard was for disabled-indicators to be the default with a toggle to enable it. I was waiting on the toggle text/mockup to implement that side of it.

But I can flip that logic easily enough and disable it by default. Working on it.

[Ted Gould (ted)]

The plan, which was signed off by design and Security in May is to do the following:

Settings
We will reuse the setting for the infographics. You export all information to the greeter or none. If you disable it all of the indicators and the infographics will be disabled. No fine grained control.

Messaging Menu
In the messaging on the greeter we will have all messages that are in the session. But on those messages we will only have the sender and the timestamp. There'll be no preview or other information shown about the message. Removing an item from the messaging menu in the greeter will update the state of the indicator in the session including the "clear all" functionality.

Date & Time Menu
We'll provide only the next five calendar items and the next alarms. Servicing an alarm in the greeter disables it for the session as well. Calendar items will prompt opening the calendar, which may require entering a PIN. We'll ensure that the alarm state on the panel is also conveyed.

Transfers Menu
On the transfers menu we'll keep the state of the icon the same as that in the session. In the menu we'll provide an aggregate of all transfers and provide the functionality to stop all of the current transfers. Individual transfer control will not be provided along with selecting a previous transfer to open the application. That functionality will only be provided in the session.

Sound Menu
We'll provide access to the currently playing media player. This includes the current track/album/artist information along with control of the media player. Volume will also be controllable.

[Ted Gould (ted)]

Note, that e-mail was written in the context of the split greeter, but I don't believe the design changes based on that engineering distinction.

[Michael Terry (mterry)]

And Ted, I believe unity8 exports all the information the indicators need. If as you implement things, you find that's not true, let me know.

[Ted Gould (ted)]

Added bug tasks for the indicators that need greeter profiles as discussed above.

[Launchpad Janitor (janitor)]

This bug was fixed in the package gsettings-ubuntu-touch-schemas - 0.0.3+14.10.20140827-0ubuntu1

---------------
gsettings-ubuntu-touch-schemas (0.0.3+14.10.20140827-0ubuntu1) utopic; urgency=medium

  [ Michael Terry ]
  * Add EnableLauncherWhileLocked and EnableIndicatorsWhileLocked properties
    to com.ubuntu.AccountsService.SecurityPrivacy (LP: #1358340)
 -- Ubuntu daily release <email address hidden> Wed, 27 Aug 2014 14:32:53 +0000

[Launchpad Janitor (janitor)]

This bug was fixed in the package ubuntu-system-settings - 0.3+14.10.20140828.3-0ubuntu1

---------------
ubuntu-system-settings (0.3+14.10.20140828.3-0ubuntu1) utopic; urgency=low

  [ Michael Terry ]
  * Implement the "When locked, allow:" portion of the Security &
    Privacy panel, so now the user can control whether the launcher
    and/or indicators are available while locked. (LP: #1358340) (LP:
    #1358340)
 -- Ubuntu daily release <email address hidden> Thu, 28 Aug 2014 18:11:51 +0000

[Launchpad Janitor (janitor)]

This bug was fixed in the package unity8 - 8.00+14.10.20140828.1-0ubuntu1

---------------
unity8 (8.00+14.10.20140828.1-0ubuntu1) utopic; urgency=low

  [ Michael Terry ]
  * Reverse default for the user option "allow launcher/panel in greeter
    when locked." And allow that property to be controlled by an
    AccountsService property. (LP: #1358340) (LP: #1358340)
  * With recent password support, we want to be able to unlock the
    device even with a password set. And we need to be able to do this
    once the new adbd lands. So I've added a DBus command to hide the
    greeter. This should be secure because all apps are constrained and
    if you're on the local session bus unconstrained, you already have
    access to anything you want.
 -- Ubuntu daily release <email address hidden> Thu, 28 Aug 2014 20:06:41 +0000

[Launchpad Janitor (janitor)]

This bug was fixed in the package unity8 - 8.00+14.10.20140903.1~rtm-0ubuntu1

---------------
unity8 (8.00+14.10.20140903.1~rtm-0ubuntu1) 14.09; urgency=low

  [ Nick Dedekind ]
  * Support for nested prompt session. (LP: #1358388)
 -- Ubuntu daily release <email address hidden> Wed, 03 Sep 2014 07:58:49 +0000

[Victor Tuson Palau (vtuson)]

please retarget this

[Ted Gould (ted)]

https://wiki.ubuntu.com/SecurityAndPrivacySettings#Phone

So I'm interpreting this as "Messages on Welcome Screen" is related to the data being shown on the welcome screen. Where the messages and notification settings is a Unity setting which just blocks the whole panel.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Jamie Strandboge (jdstrand)]

"So I'm interpreting this as "Messages on Welcome Screen" is related to the data being shown on the welcome screen. Where the messages and notification settings is a Unity setting which just blocks the whole panel."

I'm confused by this comment. The information presented in the inforgraphics/welcome screen is considerably different than those in the indicators as mentioned here: https://lists.launchpad.net/ubuntu-phone/msg09966.html.

I'm very much hoping that these won't be grouped under a single checkbox. Infographics by default seems fine since there is no specific information that can be gleaned, but I recognize some people will want to disable it. Indicators, particularly those for messaging, calendar and connecting to networks via indicator-network, should be different. Messaging and calendar should be configurable, but indicator-network should not. (Please see aforementioned thread for context).

[Ted Gould (ted)]

Looked and there doesn't seem to be any actions for datetime.

[Ted Gould (ted)]

Note: silo 13 is gathering all the pieces for this.

[Ted Gould (ted)]

So we're basically looking at it as three levels:

1) Everything on lock screen. You like that, dont' care.
2) Reduced data, stuff is there, but it shouldn't be a really egregious leak or control things.
3) No Indicators

Basically the "MessagesWelcomeScreen" toggles between the first two. Then the no indicators setting will turn on 3 or not. So for those who are very worried about security they can turn off indicators entirely. For those who'd like them to be a bit more restricted but still available we can reduce the data set. And for those who live on a desert island by themselves they have the full monty option as well.

[Jamie Strandboge (jdstrand)]

That sounds quite reasonable. Thanks for the update.

[Launchpad Janitor (janitor)]

This bug was fixed in the package indicator-messages - 13.10.1+15.04.20141103-0ubuntu1

---------------
indicator-messages (13.10.1+15.04.20141103-0ubuntu1) vivid; urgency=low

  [ Ted Gould ]
  * Add filtering for lock screen. (LP: #1358340)

  [ Lars Uebernickel ]
  * libmessaging-menu: allow numbers in object paths (LP: #1384811)
  * libmessaging-menu: fix section link in the documentation and add
    descriptions (LP: #1313561)
 -- Ubuntu daily release <email address hidden> Mon, 03 Nov 2014 20:56:30 +0000

[Launchpad Janitor (janitor)]

This bug was fixed in the package indicator-transfer - 0.1+15.04.20141103-0ubuntu1

---------------
indicator-transfer (0.1+15.04.20141103-0ubuntu1) vivid; urgency=low

  [ Ted Gould ]
  * Fix menu path cut-and-paste error (LP: #1358340)
 -- Ubuntu daily release <email address hidden> Mon, 03 Nov 2014 21:08:21 +0000

[Launchpad Janitor (janitor)]

This bug was fixed in the package indicator-sound - 12.10.2+15.04.20141105-0ubuntu1

---------------
indicator-sound (12.10.2+15.04.20141105-0ubuntu1) vivid; urgency=medium

  [ Ted Gould ]
  * Remove various Vala warnings
  * Show notifications on volume change (LP: #1378564, #1378961)
  * Warn on high audio levels when using headphones (LP: #1232633, #1373404)
  * service.vala: don't call set_volume unnecessarily (LP: #1381871)
  * Integration test for audio roles
  * Integration test for silent mode
  * Ensure the greeter menu matches whether song metadata should be shown,
    and update the metadata based on the new setting. (LP: #1358340)
 -- Ubuntu daily release <email address hidden> Wed, 05 Nov 2014 17:56:29 +0000

[Michał Sawicz (saviq)]

There is at least a unity8 branch that did not get released yet: lp:~mterry/unity8/greeter-profiles, not sure why the status was Fix Released for it.

It shouldn't be Fix Released for ubuntu-ux either, should it?

[Michael Terry (mterry)]

I emailed Olga these questions, but figured it would be good to clear this up here too:

I see from the discussion in bug 237155 (particularly comment 20), that it looks like the three settings should be controlled like so:

(A) There is a currently hidden property in System Settings called "Messages on welcome screen" that should be shown.
(B) There is also a property called "When locked, allow notifications and quick settings"

- Full indicators [1] will be used when the phone is unlocked (i.e. swipe mode) OR A and B are on.
- Limited indicators [2] will be used when the phone is locked and A is off but B is on.
- No indicator access will be used when the phone is locked and A and B are off.

And the default for A should be off and the default for B should be on?

[1] This is the "phone" indicator profile
[2] This is the "phone_greeter" indicator profile

How correct is all that? If correct, having setting A be off by default might confuse users. I feel like it should be under an "if locked" clause too.

[Michael Terry (mterry)]

mpt mentioned to me in email that he doesn't like the idea of the limited indicators at all. (sorry, trying to move ad-hoc email discussions here, but sent wrong bug link to them at first)

Can we get some unified design guidance in this bug?

[Matthew Paul Thomas (mpt)]

It's not that I don't like them, I just think they're not a good use of time when it's fairly likely that the indicator menus will soon be simplified drastically. But I see from this bug report that the profiles have mostly been implemented already, so that argument no longer applies.

[Michael Terry (mterry)]

OK. I assume that means we should continue implementing it... Then I need answers to the questions in comment #26.

[Olga Kemmet (olga-kemmet)]

"And the default for A should be off and the default for B should be on?"
I would say yes, at least for the time being.
Maybe an easier overview of these settings for the user is needed.
[A] - always allow
[B] - restricted access
[C] - no access
They obviously will need better wording and some explanation to users what they set. :)
The default would be [A]. And anything else can be set by the user. I feel that currently it is rather confusing.

[Michael Terry (mterry)]

OK well I'm going to go ahead and try to finish this work up by implementing what's in comment #26. Comment #30 lays out a simpler configuration screen, but it's not clear to me how final that is, or when it will be. So unless I hear otherwise, I'm going to start with #26. Olga, let me know when you & your team are ready to sign off on something like #30.

[Olga Kemmet (olga-kemmet)]

Hi Michael

We are currently working on a solution regarding comment #30.
Most likely Paty is going to be the person working on indicators and
greeter related stuff. However, we are in the mids of prepping for the Cape
Town sprint, and a lot of designs are work in progress.
Just go ahead with your plan and we will keep you posted.

Oh, btw Paty meet Michael and Michael meet Paty. :)

Cheers
-ok

On 4 February 2015 at 18:50, Michael Terry <email address hidden>
wrote:

> OK well I'm going to go ahead and try to finish this work up by
> implementing what's in comment #26. Comment #30 lays out a simpler
> configuration screen, but it's not clear to me how final that is, or
> when it will be. So unless I hear otherwise, I'm going to start with
> #26. Olga, let me know when you & your team are ready to sign off on
> something like #30.
>
> --
> You received this bug notification because you are a bug assignee.
> https://bugs.launchpad.net/bugs/1358340
>
> Title:
> [Indicators] Complete greeter profiles
>
> Status in The Date and Time Indicator:
> Invalid
> Status in The Messaging Menu:
> Fix Released
> Status in Transfer Indicator:
> Fix Released
> Status in Ubuntu UX bugs:
> Fix Released
> Status in The Unity 8 shell:
> Fix Released
> Status in gsettings-ubuntu-touch-schemas package in Ubuntu:
> Fix Released
> Status in indicator-datetime package in Ubuntu:
> Invalid
> Status in indicator-messages package in Ubuntu:
> Fix Released
> Status in indicator-sound package in Ubuntu:
> Fix Released
> Status in indicator-transfer package in Ubuntu:
> Fix Released
> Status in ubuntu-system-settings package in Ubuntu:
> Fix Released
> Status in unity8 package in Ubuntu:
> In Progress
> Status in unity8 package in Ubuntu RTM:
> New
>
> Bug description:
> A recent change in the interest of security removed access to the
> indicators when the phone is locked and the greeter is showing.
>
> This was an accentual change based on a misunderstanding
>
> There had been a plan to support media playback control via the sound
> indicator. Without this the user must unlock the phone in order to
> simply pause the music or change songs, etc.
>
> ----------------------------
> Desired resolution:
>
> - Revert the change that caused this issue
>
> - Add a switch to System Settings to enable security conscious user to
> switch off Launcher and Greeter access while the phone is locked.
> This setting should *always* be off by default.
> <https://wiki.ubuntu.com/SecurityAndPrivacySettings#Locking>
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/indicator-datetime/+bug/1358340/+subscriptions
>

--
Olga Kemmet
UX Lead Designer
Product Strategy | Apps | London, UK
ubuntu.com

canonical.com

twitter: @kemmko m: [phone]

[Michael Terry (mterry)]

OK, after looking at this some more, I'm not going to implement comment #26 yet. There was one case left off that complicated matters (locked and A is on but B is off -- in this case, we'd enable indicators even though they asked us not to? We could disable A when B is off, but they are in separate screens and not obviously connected).

So my current thinking is to land a branch that enables all the underpinnings of the shell changing profiles on the fly, but just not use it quite yet until the settings panel design is done. This support would also be useful for a split greeter. So it's all good changes. But I'm going to hold off on actually using the dynamic profile switching logic.

So to be clear, I'm not going to make the A option visible yet, nor change how B disables/enables the indicators when locked. But I will land some code that makes such changes much easier in future.

[Michael Terry (mterry)]

For the record, the latest version of unity8 in vivid (8.02+15.04.20150211-0ubuntu1) internally supports greeter profiles. I'm waiting on the design for System Settings before flipping the switch inside to start using it.

[Nick Dedekind (nick-dedekind)]

I don't think we need to worry about this re profiles. The implementation of what the options in Settings do is a design/backend decision. I believe the defaults are correct already.

That said, we should enable the indicator profile switching.